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Foreword 



This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3 GPP and ETSI identities can be found under 
http ://webapp . etsi .org/key/query f orm. asp . 

The 3 GPP Confidentiality and Integrity Algorithms f8 & f9 have been developed through the collaborative efforts of the 
European Telecommunications Standards Institute (ETSI), the Association of Radio Industries and Businesses (ARIB), 
the Telecommunications Technology Association (TTA), the Tl Committee. 

The f8 & f9 Algorithms Specifications may be used only for the development and operation of 3G Mobile 
Communications and services. Every Beneficiary must sign a Restricted Usage Undertaking with the Custodian and 
demonstrate that he fulfills the approval criteria specified in the Restricted Usage Undertaking. 

Furthermore, Mitsubishi Electric Corporation holds essential patents on the Algorithms. The Beneficiary must get a 
separate IPR License Agreement from Mitsubishi Electronic Corporation Japan. 

For details of licensing procedures, contact ETSI, ARIB, TTA or Tl. 



The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



This specification has been prepared by the 3GPP Task Force, and gives a detailed specification of the 3GPP Algorithm 
KASUMI. KASUMI is a block cipher that forms the heart of the 3GPP confidentiality algorithm/5, and the 3GPP 
integrity algorithm/9. 

This document is the second of four, which between them form the entire specification of the 3 GPP Confidentiality and 
Integrity Algorithms: 

- 3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document l:f8 and 
f9 Specification". 

- 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services and 
System Aspects; 3G Security; Specification of the 3GPP Confidentiahty and Integrity Algorithms; 
Document 2: KASUMI Specification". 
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- 3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 3: 
Implementors" Test Data". 

- 3 GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 4: Design 
Conformance Test Data" . 

The normative part of the specification of KASUMI is in the main body of this document. The annexes to this 
document are purely informative. Annex 1 contains illustrations of functional elements of the algorithm, while Annex 2 
contains an implementation program listing of the cryptographic algorithm specified in the main body of this document, 
written in the programming language C. 

Similarly the normative part of the specification of the/5 (confidentiality) and the f9 (integrity) algorithms is in the 
main body of Document 1. The annexes of those documents, and Documents 3 and 4 above, are purely informative. 
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Scope 



This specification gives a detailed specification of the 3GPP Algorithm KASUMI. KASUMI is a block cipher that 
forms the heart of the 3GPP confidentiality algorithm /5, and the 3GPP integrity algorithm /5^. 
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NORMATIVE SECTION 

This part of the document contains the normative specification of the KASUMI algorithm. 
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1 Outline of the normative part 

Section 2 introduces the algorithm and describes the notation used in the subsequent sections. 
Section 3 defines the algorithm structure and its operation. 
Section 4 defines the basic components of the algorithm. 

1.1 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 33.102 version 3.2.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Security Architecture". 

[2] 3GPP TS 33.105 version 3.1.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Cryptographic Algorithm Requirements". 

[3] 3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 1: f8 and f9 Specification". 

[4] 3 GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 2: KASUMI Specification". 

[5] 3 GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 3: Implementors" Test Data". 

[6] 3 GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 4: Design Conformance Test Data". 

[7] ISO/IEC 9797-1 : 1999: "Information technology - Security techniques - Message Authentication 

Codes (MACs)". 



Introductory information 



2.1 Introduction 

Within the security architecture of the 3GPP system there are two standardised algorithms: A confidentiality algorithm 
f8, and an integrity algorithm /9. These algorithms are fully specified in a companion document[3]. Each of these 
algorithms is based on the KASUMI algorithm that is specified here. 

KASUMI is a block cipher that produces a 64-bit output from a 64-bit input under the control of a 128-bit key. 
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2.2 Notation 

2.2.1 Radix 

We use the prefix Ox to indicate hexadecimal numbers. 

2.2.2 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of sub-strings, the 
left most (most significant) sub-string consists of the most significant part of the original string and so on through to the 
least significant. 

For example if a 64-bit value X is subdivided into four 16-bit substrings P, Q, R, S we have: 

X = 0x0123456789ABCDEF 

we have: 

P = 0x0123, Q = 0x4567, R = Ox89AB, S = OxCDEF. 

In binary this would be: 

Z= 0000000100100011010001010110011110001001101010111100110111101111 

with P = 0000000 1 00 1 000 1 1 

2 = 0100010101100111 

/? = 1000100110101011 
5=1100110111101111 

2.2.3 Conventions 

We use the assignment operator "=", as used in several programming languages. When we write 

<variable> = <expression> 
we mean that <variahle> assumes the value that <expression> had before the assignment took place. For instance, 

x = x + y + ?> 
means 

(new value of x) becomes (old value of x) + (old value ofy) + ?>. 

2.2.4 Subfunctions 

KASUMI decomposes into a number of subfunctions (FL, FO, FI) which are used in conjunction with associated sub- 
keys (KL, KO, KI) in a Feistel structure comprising a number of rounds (and rounds within rounds for some 
subfunctions). Specific instances of the function and/or keys are represented by XXij where / is the outer round number 
of KASUMI andj is the inner round number. 

For example the function FO comprises three rounds of the function FI, so we designate the third round of FI in the 
fifth round of KASUMI as FI53. 
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2.2.5 List of Symbols 

= The assignment operator. 

© The bitwise exclusive-OR operation. 

II The concatenation of the two operands. 

«<n The left circular rotation of the operand by n bits. 

ROL( ) The left circular rotation of the operand by one bit. 

n The bitwise AND operation. 

u The bitwise OR operation. 



2.3 List of Functions and Variables 

fi( ) The round function for the i* round of KASUMI 

FI() A subfunction within KASUMI that translates a 16-bit input to a 16-bit output using a 16-bit 

subkey. 

FL() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using a 32-bit 

subkey. 

F0() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using two 48-bit 

subkey s. 

K A 128-bit key. 

KLi,KOi,KIi subkeys used within the i* round of KASUMI. 



S7[] 
S9[] 



An S-Box translating a 7 -bit input to a 7 -bit output. 
An S-Box translating a 9-bit input to a 9-bit output. 



3.1 



KASUMI operation 



Introduction 



(See figure 1 in Annex 1) 

KASUMI is a Feistel cipher with eight rounds. It operates on a 64-bit data block and uses a 128-bit key. In this section 
we define the basic eight-round operation. In section 4 we define in detail the make-up of the round function/^ ). 
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3.2 Encryption 

KASUMI operates on a 64-bit input / using a 128-bit key K to produce a 64-bit output OUTPUT, as follows: 

The input / is divided into two 32-bit strings Lq and Rq, where 

I = LollRo 

Then for each integer / with 1 < / < 8 we define: 

Ri = Li.i, Li = Ri.iefi(Li.i,RKi) 

This constitutes the i* round function of KASUMI, where yj denotes the round function with L^./ and round key 
RKi as inputs (see section 4 below). 

The result OUTPUT is equal to the 64-bit string {Lg II Rg) offered at the end of the eighth round. See figure 1 of 
Annex 1. 

In the specifications for the/5 and/P functions we represent this transformation by the term: 

OUTPUT = KASUMI[ / ]k 



Components of KASUMI 



4.1 Function fi 

(See figure 1 in Annex 1) 

The function /•( ) takes a 32-bit input / and returns a 32-bit output O under the control of a round key RKi, where the 
round key comprises the subkey triplet of (KLt, KOt, Kit). The function itself is constructed from two sub functions; FL 
and FO with associated subkey s KLt (used with FL) and subkeys KOi and Kit (used with FO). 

The/( ) function has two different forms depending on whether it is an even round or an odd round. 

For rounds 1,3,5 and 7 we define: 

fi(I, RKi) = FO( FL( I, KLi), KOi, Kli ) 
and for rounds 2,4,6 and 8 we define: 

fi(I, RKi) = FL( FO( I, KOi, Kli ), KLi ) 

i.e. For odd rounds the round data is passed through FL( ) and then F0( ), whilst for even rounds it is passed through 
F0( ) and then FL( ). 

4.2 Function FL 

(See figure 4 in Annex 1) 

The input to the function FL comprises a 32-bit data input / and a 32-bit subkey KLt. The subkey is split into two 16- 
bit subkeys, KLfj and KLt 2 where 

KLi = KLii II KLi,2. 

The input data / is split into two 16-bit halves, L and R where I = L\\R. 

We define: 

R' = R®ROL(Ln KLti) 
L' = L®ROL(R'u KLi2) 

The 32-bit output value is (L' WR"). 
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4.3 Function FO 

(See figure 2 in Annex 1) 

The input to the function FO comprises a 32-bit data input / and two sets of subkeys, a 48-bit subkey KOt and 48-bit 
subkey Kit. 

The 32-bit data input is spHt into two halves, Lq and Rq where I = Lo\\Ro- 

The 48-bit subkeys are subdivided into three 16-bit subkeys where 

KOi = KOi,i II KOi,2 II KOi,3 and Kli = KIi,i II KIi,2 II KIi,3. 

Then for each integerj with 1 <7 < 3 we define: 

Rj = FKLjj e KOij , Kit J ) © Rj-i 

Finally we return the 32-bit value (L3 II R3). 

4.4 Function Fl 

(See figure 3 in Annex 1 . The thick and thin lines in this diagram are used to emphasise the difference between the 
9-bit and 7-bit data paths respectively). 

The function FI takes a 16-bit data input / and 16-bit subkey Kly. The input / is split into two unequal components, a 
9-bit left half Lo and a 7-bit right half 7?^ where I = Lo\\Ro. 

Similarly the key KI^ is split into a 7-bit component Klijj and a 9-bit component KIij2 where Kly = Klijj II KIij2. 

The function uses two S-boxes, S7 which maps a 7-bit input to a 7-bit output, and S9 which maps a 9-bit input to a 9-bit 
output. These are fully defined in section 4.5. It also uses two additional functions which we designate ZE( ) and TR( ). 
We define these as: 

ZE( X ) takes the 7-bit value x and converts it to a 9-bit value by adding two zero bits to the most-significant end. 

TR( X ) takes the 9-bit value x and converts it to a 7-bit value by discarding the two most-significant bits. 

We define the following series of operations: 

Li=Ro Ri=S9[Lo]®ZE(Ro) 

L2=Ri® KIij2 R2 = S7[Lj] e TRiRj) Kltji 

L3 =R2 R3 = S9[L2] © ZE(R2) 

L4 = S7[L3]®TR(R3) R4 = R3 
The function returns the 16-bit value (L4 II R4). 



ETSI 



3GPP TS 35.202 version 9.0.0 Release 9 13 ETSI TS 135 202 V9.0.0 (2010-02) 

4.5 S-boxes 

The two S-boxes have been designed so that they may be easily implemented in combinational logic as well as by a 
look-up table. Both forms are given for each table. 

The input X comprises either seven or nine bits with a corresponding number of bits in the output j. We therefore have: 

x=x8\\ x7 II x6 II x5 II x4 II x3 II x2 II xl II xO 
and 

y =y8 \\y7 \\y6 WyS \\y4 \\y3 \\y2 Wyl WyO 

where the xS, y8 and x7j7 bits only apply to S9, and the xO mid yO bits are the least significant bits. 

In the logic equations: 

x0xlx2 implies xO n xl n x2 where n is the AND operator. 
is the exclusive-OR operator. 

Following the presentation of the logic equations and the equivalent look-up table an example is given of the use of 
each. 

4.5.1 S7 

Gate Logic : 

yO =xlx3©x4ex0xlx4ex5©x2x5©x3x4x5©x6©x0x6©xlx6©x3x6©x2x4x6©xlx5x6 

©x4x5x6 
yl =x0xl©x0x4©x2x4©x5©xlx2x5©x0x3x5©x6©x0x2x6©x3x6©x4x5x6©l 
y2 =x0©x0x3©x2x3©xlx2x4©x0x3x4©xlx5©x0x2x5©x0x6©x0xlx6©x2x6©x4x6©l 
y3 =xl©x0xlx2©xlx4©x3x4©x0x5©x0xlx5©x2x3x5©xlx4x5©x2x6©xlx3x6 
y4 =x0x2©x3©xlx3©xlx4©x0xlx4©x2x3x4©x0x5©xlx3x5©x0x4x5©xlx6©x3x6 

©X0x3x6©x5x6©l 
y5 =x2©x0x2©x0x3©xlx2x3©x0x2x4©x0x5©x2x5©x4x5©xlx6©xlx2x6©x0x3x6 

©X3x4x6©x2x5x6©l 
y6 =xlx2©x0xlx3©x0x4©xlx5©x3x5©x6©x0xlx6©x2x3x6©xlx4x6©x0x5x6 



Decimal Table : 


























54, 50, 62, 56, 


22, 


34, 


94, 


96, 


38, 


6, 


63, 


93, 


2, 


18, 


,123, 


33, 


55,113, 39,114, 


21, 


67, 


65, 


12, 


47, 


73, 


46, 


27, 


25, 


111, 


,124, 


81, 


53, 9,121, 79, 


52, 


60, 


58, 


48, 


101, 


127, 


40, 


120, 


104, 


70, 


71, 


43, 


20,122, 72, 61, 


23, 


109, 


13, 


100, 


77, 


1, 


16, 


7, 


82, 


10, 


,105, 


98, 


117,116, 76, 11, 


89, 


106, 


0, 


125, 


118, 


99, 


86, 


69, 


30, 


57, 


,126, 


87, 


112, 51, 17, 5, 


95, 


14, 


90, 


84, 


91, 


8, 


35, 


103, 


32, 


97, 


, 28, 


66, 


102, 31, 26, 45, 


75, 


4, 


85, 


92, 


37, 


74, 


80, 


49, 


68, 


29, 


,115, 


44, 


64,107,108, 24, 


110, 


83, 


36, 


78, 


42, 


19, 


15, 


41, 


88, 


119, 


, 59, 


3 



Example: 

If we have an input value = 38, then using the decimal table S7[38] = 58. 
For the combinational logic we have: 

38 = 01001 IO2 => x6 = 0, x5=l, x4=0, x3=0, x2=l, xl=l, xO=0 
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which gives us: 



yo = oeoeoe i e i eoeoeoeoeoeoeoeo = o 
yi = oeoeoeieieoeoeoeoeoei = i 

y2 = oeoeoeoeoe i eoeoeoeoeoe i = o 
y3 = leoeoeoeoeoeoeoeoeo = i 

y4 = oeoeoeoeoeoeoeoeoeoeoeoeoei = i 
y5 = 1 eoeoeoeoeoe ieoeoeoeoeoeoei= i 
y6 = 1 eoeoe i eoeoeoeoeoeo = o 



Thus y = 01110102 = 58 



4.5.2 S9 



Gate Logic 



yO = X0x2ex3©x2x5©x5x6©x0x7exlx7ex2x7ex4x8©x5x8©x7x8©l 

yl = Xl©x0xl©x2x3©x0x4©xlx4©x0x5©x3x5©x6©xlx7©x2x7©x5x8©l 

y2 = Xl©x0x3©x3x4©x0x5©x2x6©x3x6©x5x6©x4x7©x5x7©x6x7©x8©x0x8©l 

y3 = X0©xlx2©x0x3©x2x4©x5©x0x6©xlx6©x4x7©x0x8©xlx8©x7x8 

y4 = X0xl©xlx3©x4©x0x5©x3x6©x0x7©x6x7©xlx8©x2x8©x3x8 

y5 = X2©xlx4©x4x5©x0x6©xlx6©x3x7©x4x7©x6x7©x5x8©x6x8©x7x8©l 

y6 = X0©x2x3©xlx5©x2x5©x4x5©x3x6©x4x6©x5x6©x7©xlx8©x3x8©x5x8©x7x8 

y7 = X0xl©x0x2©xlx2©x3©x0x3©x2x3©x4x5©x2x6©x3x6©x2x7©x5x7©x8©l 

y8 = X0xl©x2©xlx2©x3x4©xlx5©x2x5©xlx6©x4x6©x7©x2x8©x3x8 

Decimal Table : 



167, 
183, 
175, 

95, 
165, 
501, 
232, 
344, 
487, 
475, 
363, 
439, 
465, 
173, 
280, 
132, 

35, 

50, 

72, 

185, 

1, 

336, 

47, 
414, 
266, 
311, 
485, 
312, 
284, 

97, 
438, 

43, 



239, 
253, 
241, 

197, 
407, 
158, 
300, 
446, 
384, 
292, 
506, 
416, 
222, 
383, 
225, 
103, 
116, 

26, 
233, 
109, 
318, 

85, 
486, 
351, 
352, 
422, 
377, 
353, 

30, 
477, 

66, 



161, 
147, 
489, 
315, 
395, 
249, 
134, 
276, 
482, 
508, 

46, 
208, 
252, 
418, 
373, 
203, 
125, 

7i 

342, 

389, 

375, 

4, 

25, 
394, 
343, 
328, 
248, 
7, 
105, 
310, 
387, 

60, 



379, 
331, 

37, 
245, 
121, 
265, 
354, 
242, 

41, 

53, 
499, 
271, 
287, 

67, 
128, 
316, 
427, 
410, 
150, 

71, 
137, 
504, 
497, 

96, 
144, 
141, 
297, 
468, 
390, 
219, 
122, 
455, 



391, 
415, 
206, 

54, 
257, 

89, 

13, 
437, 

68, 
112, 
393, 
349, 
246, 
386, 
382, 
234, 

19, 

10, 
313, 
448, 
181, 
492, 
474, 

99, 
441, 
396, 

23, 
194, 
299, 

94, 
192, 
341, 



334, 
340, 

17, 
235, 
480, 
186, 
250, 
320, 
156, 
170, 
327, 
401, 
6. 
368, 
408, 

14, 
214, 
205, 
490, 
273, 

88 
259 
289 
154 
365 
346 
213 
2 
471 
160 

42 
445 



9, 
51, 
0. 
218, 
423, 
221, 
491, 
113, 
457, 
479, 
324, 
434, 
83, 
261, 
155, 
301, 
453, 
510, 
431, 
372, 
75, 
304, 
100, 
511, 
108, 
123, 
130, 
117, 
470, 
129, 
381, 
202, 



338, 
362, 
333, 
405, 
212, 
428, 
142, 
278, 
131, 
151, 

24, 
236, 
305, 
101, 
495, 

91, 
146, 
171, 
238, 

55, 
30i 

77, 
269, 
148, 
298, 
319, 
466, 
295, 
184, 
493, 
5. 
432, 



3i 
306, 

44, 
472, 
240, 
164, 
191, 

11, 
326, 
126, 
456, 

16, 
420, 
476, 
367, 
503, 
498, 
231, 
411, 
110, 
260, 
337, 
296, 
413, 
251, 
450, 

22, 
463, 

57, 

64, 
145, 



226, 
500, 
254, 
264, 
28, 
74, 
69, 
243, 
403, 
169, 
267, 
209, 
345, 
291, 
36 
286, 
314, 
45, 
325, 
178, 
484, 
435, 
478, 
361, 
34, 
281, 
217, 
258, 
200, 
179, 
118, 
237, 



48, 
262, 
378, 
172, 
462, 
440, 
193, 

87, 
339, 

73, 
157, 
359, 
153, 
195, 
274, 
424, 
444, 
139, 
149, 
322, 

98, 

21, 
270, 
409, 
182, 
429, 
283, 
224, 
348, 
263, 
180, 

15, 



358, 

82, 

5i 
494, 
176, 
196, 
425, 
317, 

20, 
268, 
460, 

52, 
502, 
430, 
107, 
211, 
230, 
467, 
473, 

12, 
272, 
357, 
106, 
255, 
509, 
228, 

70, 
447, 

63, 
102, 
449, 
376, 



452, 

216, 

143, 

371, 

406, 

458, 

152, 

36, 

39, 

279, 

488, 

56, 

65, 

49, 

459, 

347, 

256, 

29, 

40, 

469, 

370, 

303, 

31, 

162, 

138, 

443, 

294, 

247, 

204, 

189, 

293, 

436, 



385, 
159, 
220, 
290, 
507, 
421, 
227, 

93, 
115, 
321, 
426, 
120, 

61, 

79, 
417, 
307, 
329, 

86, 
119, 
392, 
275, 
332, 
104, 
215, 
210, 
481, 
360, 
187, 
IE 
207, 
323, 
464, 



90, 
356, 

81, 
399, 
288, 
350, 
366, 
496, 
442, 
168, 
309, 
199, 
244, 
166, 

62, 
140, 
198, 
505, 
174, 
369, 
412, 
483, 
433, 
302, 
335, 

92, 
419, 

80, 

33, 
114, 
136, 

59, 



397, 
177, 
400, 

76, 
223, 
163, 
135, 

27, 
124, 
364, 
229, 
277, 
282, 
330, 
454, 
374, 
285, 

32, 
355, 
190, 
111, 

18, 

84, 
201, 
133, 
404, 
127, 
398, 
451, 
402, 
380, 
461 
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Example: 

If we have an input value = 138, then using the decimal table S9[138] = 339. 
For the combinational logic we have: 

138 = OIOOOIOIO2 => x8 = 0, x7 = 1, x6 = 0, x5=0, x4=0, x3=l, x2=0, xl=l, xO=0 
which gives us: 

yo = 00 1 eoeoeoe i eoeoeoeoe i = i 
yi = leoeoeoeoeoeoeoeieoeoei = i 
y2 = leoeoeoeoeoeoeoeoeoeoeoei = o 

y3 = oeoeoeoeoeoeoeoeoeoeo = o 

y4 = 00 1 eoeoeoeoeoeoeoeo = i 
y5 = oeoeoeoeoe i eoeoeoeoeoe i = o 
y6 = oeoeoeoeoeoeoeoeieoeoeoeo = i 
y7 = oeoeoeieoeoeoeoeoeoeoeoei = o 

y8 = oeoeoeoeoeoeoeoeieoeo = i 

Thus y= 1010100112 = 339 



4.6 Key Schedule 



KASUMI has a 128-bit key K. Each round of KASUMI uses 128 bits of key that are derived from K. Before the round 
keys can be calculated two 16-bit arrays Kj and Kj^ (j=l to 8) are derived in the following manner: 

The 128-bit key K is subdivided into eight 16-bit values K1,,,K8 where 

K = K1IIK2IIK3II...IIK8. 

A second array of subkeys, Kj^ is derived from Kj by applying: 

For each integer 7 with 1 <7 < 8 

Kj'= Kjecj 

Where Cj is the constant value defined in table 2. 
The round subkeys are then derived from Kj and Kj ' in the manner defined in table 1 . 

Table 1 : Round subkeys 



KLi,i 
KLi,2 

KOii 
K0i,2 
K0i,3 

Kli,i 

Kli,2 
Kli,3 



1 


2 


3 


4 


5 


6 


7 


8 


K1«<1 


K2«<1 


K3«<1 


K4«<1 


K5«<1 


K6«<1 


K7«<1 


K8«<1 


K3' 


K4' 


K5' 


K6' 


K7' 


K8' 


K^' 


K2' 


K2«<5 


K3«<5 


K4«<5 


K5«<5 


K6«<5 


K7«<5 


K8«<5 


K1«<5 


K6«<8 


K7«<8 


K8«<8 


K1«<8 


K2«<8 


K3«<8 


K4«<8 


K5«<8 


K7«<13 


K8«<13 


K1«<13 


K2«<13 


K3«<13 


K4«<13 


K5«<13 


K6«<13 


K5' 


K6' 


K7' 


K8' 


K^' 


K2' 


K3' 


K4' 


K4' 


K5' 


K6' 


K7' 


K8' 


K^' 


K2' 


K3' 


K8' 


KV 


K2' 


K3' 


K4' 


K5' 


K6' 


K7' 
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Table 2: Constants 



C1 


0x0123 


C2 


0x4567 


C3 


0x89AB 


C4 


OxCDEF 


C5 


OxFEDC 


C6 


0xBA98 


C7 


0x7654 


C8 


0x3210 
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INFORMATIVE SECTION 

This part of the document is purely informative and does not form part of the normative specification of KASUMI. 
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Annex 1 (informative): 

Figures of the KASUMI Algorithm 





Fig. 2: FO Function 




KL. 



J,2 



Fig. 3: FI Function 




I 1 bitwise AND operation 
I J bitwise OR operation 
<^<Cj^ one bit left rotation 



Fig. 1: KASUMI 



Fig.4: FL Function 
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KASUMI has a number of characteristics that may be exploited in a hardware implementation and these are highlighted 
here. 

The simple key schedule is easy to implement in hardware. 

- The S -Boxes have been designed so that they may be implemented by a small amount of combinational logic 
rather than by large look-up tables. 

- The S7-Box and S9-Box operations in the FI function may be carried out in parallel (see alternative presentation 
in figure 5). 

- The Fli 1 and Fli 2 operations may be carried out in parallel (see alternative presentation in figure 6). 




(>^"--K3 



S9 



()<-^ 



S7 



-^) 





Fig.5: FI Function 



Fig.6: FO Function 
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Annex 2 (informative): 
Simulation Program Listing 



Header file 

/* 



Kasumi . h 



typedef unsigned char u8 ; 
typedef unsigned short ul6; 
typedef unsigned long u32; 

void KeySchedule ( u8 *key ) ; 
void Kasumi ( u8 *data ) ; 

CCode 

/* 



Kasumi . c 



* A sample implementation of KASUMI, the core algorithm for the 

* 3GPP Confidentiality and Integrity algorithms. 
* 

* This has been coded for clarity, not necessarily for efficiency. 
* 

* This will compile and run correctly on both Intel (little endian) 

* and Sparc (big endian) machines. (Compilers used supported 32 -bit ints) . 
* 

* Version 1.1 08 May 2000 

* */ 

#include "Kasumi. h" 

/* 16 bit rotate left */ 

#define R0L16(a,b) (ul6) ( (a<<b) | (a>> (16-b) ) ) 

/* unions: used to remove "endian" issues */ 

typedef union { 

u32 b32; 

ul6 bl6 [2] ; 

u8 b8 [4] ; 
} DWORD; 

typedef union { 

ul6 bl6; 

u8 b8 [2] ; 
} WORD; 

/* globals: The subkey arrays */ 



static ul6 KLil[8], KLi2 [8] ; 

static ul6 K0il[8], K0i2 [8] , K0i3 [8] ; 

static ul6 KIil[8], KIi2 [8] , KIi3 [8] ; 



* FI() 

* The FI function (fig 3) . It includes the S7 and S9 tables. 

* Transforms a 16-bit value. 

* */ 

static ul6 FI ( ul6 in, ul6 subkey ) 

{ 

ul6 nine, seven; 

static ul6 S7 [] = { 

54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18,123, 33, 
55,113, 39,114, 21, 67, 65, 12, 47, 73, 46, 27, 25,111,124, 81, 
53, 9,121, 79, 52, 60, 58, 48,101,127, 40,120,104, 70, 71, 43, 
20,122, 72, 61, 23,109, 13,100, 77, 1, 16, 7, 82, 10,105, 98, 
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117 


116 


76 


11 


89 


106 


0,125,118, 


99, 


86, 


69, 


30, 


57,126, 


87, 


112 


51 


17 


5, 


95, 


14, 


90, 


84, 


91, 


8, 35,103, 32, 97, 28, 66, 


102 


31 


26 


45 


75 


4, 


85, 


92, 


37, 


74, 


80, 


49, 


68, 


29,115, 


44, 


64,107,108, 


24,110, 


83, 


36, 


78, 


42, 


19, 


15, 


41, 


88,119, 


59, 


3}; 


static ul6 S9 [] 


= { 


























167 


239 


161 


379 


391 


334 


9 


338 


38 


226 


48 


358 


452 


385 


90 


397 


183 


253 


147 


331 


415 


340 


51 


362 


306 


500 


262 


82 


216 


159 


356 


177 


175 


241 


489 


37 


206 


17 





333 


44 


254 


378 


58 


143 


220 


81 


400 


95 


3 


315 


245 


54 


235 


218 


405 


472 


264 


172 


494 


371 


290 


399 


76 


165 


197 


395 


121 


257 


480 


423 


212 


240 


28 


462 


176 


406 


507 


288 


223 


501 


407 


249 


265 


89 


186 


221 


428 


164 


74 


440 


196 


458 


421 


350 


163 


232 


158 


134 


354 


13 


250 


491 


142 


191 


69 


193 


425 


152 


227 


366 


135 


344 


300 


276 


242 


437 


320 


113 


278 


11 


243 


87 


317 


36 


93 


496 


27 


487 


446 


482 


41 


68 


156 


457 


131 


326 


403 


339 


20 


39 


115 


442 


124 


475 


384 


508 


53 


112 


170 


479 


151 


126 


169 


73 


268 


279 


321 


168 


364 


363 


292 


46 


499 


393 


327 


324 


24 


456 


267 


157 


460 


488 


426 


309 


229 


439 


506 


208 


271 


349 


401 


434 


236 


16 


209 


359 


52 


56 


120 


199 


277 


465 


416 


252 


287 


246 


6 


83 


305 


420 


345 


153 


502 


65 


61 


244 


282 


173 


222 


418 


67 


386 


368 


261 


101 


476 


291 


195 


430 


49 


79 


166 


330 


280 


383 


373 


128 


382 


408 


155 


495 


367 


388 


274 


107 


459 


417 


62 


454 


132 


225 


203 


316 


234 


14 


301 


91 


503 


286 


424 


211 


347 


307 


140 


374 


35 


103 


125 


427 


19 


214 


453 


146 


498 


314 


444 


230 


256 


329 


198 


285 


50 


116 


78 


410 


10 


205 


510 


171 


231 


45 


139 


467 


29 


86 


505 


32 


72 


26 


342 


150 


313 


490 


431 


238 


411 


325 


149 


473 


40 


119 


174 


355 


185 


233 


389 


71 


448 


273 


372 


55 


110 


178 


322 


12 


469 


392 


369 


190 


1 


109 


375 


137 


181 


88 


75 


308 


260 


484 


98 


272 


370 


275 


412 


111 


336 


318 


4 


504 


492 


259 


304 


77 


337 


435 


21 


357 


303 


332 


483 


18 


47 


85 


25 


497 


474 


289 


100 


269 


296 


478 


270 


106 


31 


104 


433 


84 


414 


486 


394 


96 


99 


154 


511 


148 


413 


361 


409 


255 


162 


215 


302 


201 


266 


351 


343 


144 


441 


365 


108 


298 


251 


34 


182 


509 


138 


210 


335 


133 


311 


352 


328 


141 


396 


346 


123 


319 


450 


281 


429 


228 


443 


481 


92 


404 


485 


422 


248 


297 


23 


213 


130 


466 


22 


217 


283 


70 


294 


360 


419 


127 


312 


377 


7 


468 


194 


2 


117 


295 


463 


258 


224 


447 


247 


187 


80 


398 


284 


353 


105 


390 


299 


471 


470 


184 


57 


200 


348 


63 


204 


188 


33 


451 


97 


30 


310 


219 


94 


160 


129 


493 


64 


179 


263 


102 


189 


207 


114 


402 


438 


477 


387 


122 


192 


42 


381 


5 


145 


118 


180 


449 


293 


323 


136 


380 


43 


66 


60 


455 


341 


445 


202 


432 


8,237, 


15,376,436,464, 


59,461} 



/* The sixteen bit input is split into two unequal halves, ^ 
* nine bits and seven bits - as is the subkey */ 

nine = (ul6) (in>>7) ; 
seven = (ul6) (in&0x7F) ; 

/* Now run the various operations */ 



nine 
seven 



(ul6) (S9 [nine] 
(ul6) (S7 [seven] 



seven) ; 
(nine & 0x7F) 



seven ^= (subkey>>9) ; 

nine ^= (subkey&OxlFF) 

nine = (ul6) (S9 [nine] 

seven = (ul6) (S7 [seven] 



seven) ; 

(nine & 0x7F) ) ; 



in = (ul6) ( (seven<<9) + nine) ; 
return ( in ) ; 



FOO 



The FOO function. 

Transforms a 32 -bit value. Uses <index> to identify the 

appropriate subkeys to use. 



static u32 FO ( u32 in, int index ) 

{ 

ul6 left, right; 

/* Split the input into two 16-bit words */ 

left = (ul6) (in>>16) ; 
right = (ul6) in; 

/* Now apply the same basic transformation three times 



V 
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left ^= KOil [index] ; 

left = FI ( left, Klil [index] ) 

left "= right; 

right ^= K0i2 [index] ; 

right = FI ( right, KIi2 [index] 

right ^= left; 

left "= K0i3 [index] ; 

left = FI ( left, KIi3 [index] ) 

left ^= right; 

in = (( (u32) right) <<16)+left; 

return ( in ) ; 



/* 

* FLO 



The FL() function. 

Transforms a 32 -bit value. Uses <index> to identify the 

appropriate subkeys to use. 



static u32 FL ( u32 in, int index ) 

{ 

ul6 1, r, a, b; 

/* split out the left and right halves */ 

1 = (ul6) (in>>16) ; 
r = (ul6) (in) ; 

/* do the FL() operations */ 

a = (ul6) (1 & KLil [index] ) ; 
r ^= R0L16 (a,l) ; 

b = (ul6) (r I KLi2 [index] ) ; 
1 ^= R0L16 (b,l) ; 

/* put the two halves back together */ 

in = ( ( (u32) 1) <<16) + r; 

return ( in ) ; 



/' 



* Kasumi ( ) 

* the Main algorithm (fig 1) . Apply the same pair of operations 

* four times. Transforms the 64 -bit input. 

* */ 

void Kasumi ( u8 *data ) 

{ 

u32 left, right, temp; 
DWORD *d; 
int n; 

/* Start by getting the data into two 32-bit words (endian corect) */ 

d = (DWORD*) data; 

left = ( ( (u32)d[0] .b8 [0] )<<24) + ( ( (u32)d[0] .b8 [1] )<<16) 
+ (d[0] .be [2]<<8) + (d[0] .be [3] ) ; 

right = ( ( (u32) d [1] .b8 [0] ) <<24) + ( ( (u32) d [1] .b8 [1] ) <<16) 
+ (d[l] .b8 [2]<<8) + (d[l] .b8 [3] ) ; 
n = 0; 
do{ temp = FL ( left, n ); 

temp = FO ( temp, n++ ) ; 

right ^= temp; 

temp = FO ( right , n ) ; 

temp = FL ( temp, n++ ) ; 

left ^= temp; 
} while ( n<=7 ) ; 

/* return the correct endian result */ 

d[0].b8[0] = (u8) (left>>24) ; d[l].b8[0] = (u8) (right>>24 ) ; 

d[0].b8[l] = (u8) (left>>16) ; d[l].b8[l] = (u8 ) (right>>16 ) ; 
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d[0].b8[2] = (u8) (left>>8) ; d[l].b8[2] = (u8 ) (right>>8 ) ; 

d[0].b8[3] = (u8)(left); d[l].b8[3] = (u8) (right) ; 

} 

* KeySchedule ( ) 

* Build the key schedule. Most "key" operations use 16 -bit 

* subkeys so we build ul6-sized arrays that are "endian" correct. 

* */ 

void KeySchedule ( u8 *k ) 

{ 

static ul6 C[] = { 

0x0123, 0x4567, 0x89AB, OxCDEF, OxFEDC, 0xBA98 , 0x7654 , 0x3210 }; 
ul6 key [8], Kprime [8] ; 
WORD *kl6; 
int n; 

/* Start by ensuring the subkeys are endian correct on a 16 -bit basis */ 

kl6 = (WORD *)k; 

f or ( n=0; n<8; ++n ) 

key[n] = (ul6) ( (kl6 [n] .b8 [0] <<8) + (kl6 [n] .b8 [1] ) ) ; 

/* Now build the K' [] keys */ 

f or ( n=0; n<8; ++n ) 

Kprime [n] = (ul6)(key[n] ^ C [n] ) ; 

/* Finally construct the various sub keys */ 

f or ( n=0; n<8; ++n ) 

{ 

KLil [n] = R0L16 (key [n] , 1) ; 

KLi2 [n] = Kprime [ (n+2) &0x7] ; 

KOil [n] = R0L16 (key [ (n+1) &0x7] ,5) ; 

K0i2 [n] = R0L16 (key [ (n+5) &0x7] ,8) ; 

K0i3 [n] = R0L16 (key[ (n+6)&0x7] ,13) ; 

Klil [n] = Kprime [ (n+4) &0x7] 

KIi2 [n] = Kprime [ (n+3) &0x7] 

KIi3 [n] = Kprime [ (n+7) &0x7] 



/*- 



end of kasumi 
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